Granting Other Accounts with the Operation Permissions for a Specified Bucket

Updated on 2022-05-17 GMT+08:00

View PDF

The bucket owner (root account) or other accounts and IAM users, who have the permission to set bucket policies, can configure bucket policies to grant the bucket operation permissions to other accounts or IAM users under other accounts.

The following is an example about how to authorize other accounts with the bucket access and object upload permissions.

NOTE:

To grant permissions to IAM users under other accounts, you need to configure a bucket policy and also IAM policies.

Configure a bucket policy to allow IAM users to access the bucket.
Configure IAM policies for the account to which the authorized IAM user belongs, to allow the IAM user to access the bucket.

Only permissions that are allowed by both the bucket policy and IAM policies can take effect.

Procedure

In the bucket list, click the bucket to be operated. The Overview page of the bucket is displayed.
In the navigation pane on the left, click Permissions to go to the permission management page.
Choose Bucket Policies > Custom Bucket Policies.
Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.

Set the following parameters to authorize another account with the permission to access the bucket:

**Table 1** Parameters for authorizing the permission to access a specified bucket
Parameter	Value
Policy Mode	Customized
Effect	Allow
Principal	Include Select Other account. Enter the account ID and user ID. NOTE: The account ID and user ID can be obtained on the My Credential page of the account or user to be authorized. If you authorize the permission to only an account, you do not need to enter user IDs. If you want to authorize the permission to an IAM user, you need to enter the account ID and user ID. You can authorize the permission to multiple IAM users. Use commas (,) to separate the user IDs.
Resources	Include Leave it blank.
Actions	Include ListBucket

Click OK.
Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.

Set the following parameters to authorize another account with the permission to upload objects:

NOTE:

Before authorizing the user with the permission to operate objects, ensure that the user has the permission to access the bucket.

**Table 2** Parameters for authorizing the permission to upload objects
Parameter	Value
Policy Mode	Customized
Effect	Allow
Principal	Include Select Other account. Enter the account ID and user ID. NOTE: The account ID and user ID can be obtained on the My Credential page of the account or user to be authorized. If you authorize the permission to only an account, you do not need to enter user IDs. If you want to authorize the permission to an IAM user, you need to enter the account ID and user ID. You can authorize the permission to multiple IAM users. Use commas (,) to separate the user IDs.
Resources	Include Resource name: *
Actions	Include PutObject

Click OK.

Parent topic: Application Cases

Previous topic: Granting an IAM User with the Operation Permissions for a Specified Bucket

Next topic: Restricting Bucket Access to a Specified Address

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot